The present invention relates to a redundant control system and an associated control computer, peripheral unit and method for such a control system.
The high-service-quality automation system S7–400H, having a redundantly designed construction and the interface connection IM153–2, which is usable for connecting a peripheral unit ET 200M as a slave in redundant PROFIBUS-DP systems having the S7–400H, is known from Siemens catalog CA 01, 1999. This catalog was, e.g. viewable on Jun. 13, 2000 in the internet at the address http://www3.ad.siemens.de/ca01online.
In many fields of automation technology, ever more stringent requirements are placed on the service quality, and therefore on the fault tolerance, of the automation systems. There are fields in which a system stoppage would be very costly. In these cases, only redundant systems are able to meet the requirements for service quality. For example, the high-service-quality SIMATIC S7–400H continues to operate even if parts of the control system have failed due to one or more faults. It has redundantly designed central functions and is constructed using two separate central controllers as control computers. The two control computers execute the same processing programs cyclically and synchronously. They monitor each other and automatically determine which control computer is active, i.e., actually controls the process via its output data. For this purpose, data is exchanged between the two control computers via a redundancy coupling. A decentralized peripheral unit ET 200M, into which application-specific digital input/output assemblies are plugged, is coupled, using a field bus PROFIBUS-DP, to each of the two control computers. Here, the peripheral units may of course be implemented to be redundant as well.
Process information obtained with the aid of measuring transducers is relayed to both control computers by the peripheral unit. In “hot standby” operation, if the system is healthy, both control computers execute the same control program simultaneously. However, only one control computer is active, i.e., the output data of only one control computer is processed further to control the process. In case of a fault, the intact central controller takes over the control of the process alone. For this purpose, the controllers automatically receive the same user program, the same data components, the same process image contents, and the same internal data, such as times, counters, flags, etc. In this way, both controllers are always at the current state and, in case of a fault, may continue the control alone at any time. Process output data, through which the signals to be output to the actuators of the peripheral unit are selected, are provided to the peripheral unit via both field buses in normal operation. However, the peripheral unit analyzes only one set of control data received from the field buses. The control computer connected at any given time can therefore be referred to as the active control computer. If the respective active control computer fails, process output data is no longer transmitted by this control computer via the field bus, and the peripheral unit changes over to the other control computer after a predetermined monitoring time has passed. In other words, the telegrams of the other field bus are analyzed in order to generate appropriate signals for the attached actuators. The changeover therefore occurs only after serious malfunctions, which lead to failure of a field bus.
Despite the resulting overall service quality, the above-described automation system suffers from long changeover times, which are a function of the telegram cycle times. This conventional automation system also suffers from an incomplete monitoring of the transmission chain, since merely the receipt of telegrams is sufficient to establish an intact field bus, and corruption therefore remains unrecognized.